By Michele Evans / NYweeklyRecord.com / Date: 10/20/2026
Category: Consumer Protection / Public Health / Government Accountability
NEW YORK CITY, NY –
A pediatric health network knew for years that sensitive patient data sat in an unencrypted archive, yet the records remained largely unprotected until hackers stole information tied to approximately 825,000 New Yorkers, according to a new settlement announced by the attorneys general of New York and Connecticut.
Boston Children’s Health Physicians and its technology contractor, XTIUM, agreed to pay $2.7 million after investigators concluded that both companies failed to use reasonable safeguards. The settlement includes a $2.1 million penalty for New York and $540,000 for Connecticut.
The breach began at XTIUM in August 2024 and reached 18 client networks, including the pediatric practice. Hackers took names, addresses, dates of birth, treatment and billing information. More than 170,000 New Yorkers had Social Security or driver’s license numbers exposed, according to the New York attorney general.
This was not described as a hidden weakness that surfaced without warning. Investigators said a 2023 security audit identified multiple gaps, including missing standard policies, inadequate security tools, no incident-response plan and weak oversight of vendors.
The most serious warning came earlier. The attorney general’s investigation found that data-security executives knew for at least two years before the breach that the network held an unencrypted archive containing more than one million patient billing records. That archive included personal, medical and financial information. It remained largely unprotected until it was stolen.
XTIUM also failed to maintain adequate logging and monitoring for its remote-support system, investigators said. The company has not determined how the hackers gained access, according to the settlement announcement.
Patients and families trusted the network with information they could not take back once exposed. A stolen password can be changed. A Social Security number, medical history or date of birth can follow a person for life. Children face a particular risk because fraud can remain undetected until years later, when they apply for credit, housing or employment.
The settlement requires more than a payment. Boston Children’s Health Physicians and XTIUM must maintain comprehensive security programs, inventory private data, strengthen authentication, improve monitoring and alerts, and upgrade incident-response procedures.
The agreement also includes additional conditional penalties. Boston Children’s Health Physicians could owe another $1.04 million to New York and $260,000 to Connecticut if it violates the settlement terms.
No settlement can erase the exposure. The accountability question is why known problems remained unresolved while the organization continued collecting and storing deeply sensitive records.
The case also shows the limits of outsourcing. A health provider may hire an outside company to manage technology, but it cannot outsource responsibility for patient privacy. Investigators faulted the network for failing to define vendor duties and for not reasonably managing its security program.
The companies resolved the investigation without a trial. The findings described by the attorneys general are part of a civil settlement, not a criminal conviction. The breach itself occurred in 2024; the enforcement action was announced October 16, 2026.
For New Yorkers, the practical result will depend on compliance. Stronger policies matter only if the companies test them, fix flagged risks and alert patients quickly when something goes wrong. Regulators now have a settlement to enforce. Families deserve proof that the warnings will no longer sit unanswered.
Sources
New York Attorney General: $2.7 million pediatric health data settlement
Connecticut Attorney General: Boston Children’s Health Physicians and XTIUM data-breach settlement
Leave a Reply